{"id":20874,"date":"2021-12-23T17:09:00","date_gmt":"2021-12-23T17:09:00","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=20874"},"modified":"2021-12-22T19:28:22","modified_gmt":"2021-12-22T19:28:22","slug":"azurehunter","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/azurehunter\/","title":{"rendered":"AzureHunter : A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365"},"content":{"rendered":"\n<p><strong>AzureHunter<\/strong> is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes<\/p>\n\n\n\n<p class=\"has-text-align-center has-vivid-green-cyan-background-color has-background\"><strong>Getting Started<\/strong><\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><strong>Check that you have the right O365 Permissions<\/strong><\/p>\n\n\n\n<p>The following roles are required in Exchange Online, in order to be able to have&nbsp;<em>read only<\/em>&nbsp;access to the UnifiedAuditLog:&nbsp;<code>View-Only <strong>Audit Logs<\/strong><\/code>&nbsp;or&nbsp;<code><strong>Audit Logs<\/strong><\/code>.<\/p>\n\n\n\n<p>These roles are assigned by default to the&nbsp;<code><strong>Compliance Management<\/strong><\/code>&nbsp;role group in Exchange Admin Center.<\/p>\n\n\n\n<p class=\"has-luminous-vivid-amber-background-color has-background\"><strong>NOTE<\/strong>: if you are a security analyst, incident responder or threat hunter and your organization is NOT giving you&nbsp;<strong>read-only<\/strong>&nbsp;access to these audit logs, you need to seriously question what their detection and response strategy is!<\/p>\n\n\n\n<p>More information:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>How to search the Audit Log using the GUI<\/li><li>Manage role groups in Exchange Online<\/li><li>How to enable the UnifiedAuditLog<\/li><\/ul>\n\n\n\n<p class=\"has-luminous-vivid-amber-background-color has-background\"><strong>NOTE<\/strong>: your admin can verify these requirements by running&nbsp;<code><strong>Get-ManagementRoleEntry \"*\\Search-UnifiedAuditLog\"<\/strong><\/code>&nbsp;in your Azure tenancy cloud shell or local powershell instance connected to Azure.<\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"> <strong>Ensure ExchangeOnlineManagement v2 PowerShell Module is installed<\/strong><\/p>\n\n\n\n<p>Please make sure you have&nbsp;<strong>ExchangeOnlineManagement<\/strong>&nbsp;(<em>EXOv2<\/em>) installed. You can find instructions on the web or go directly to my little KB on how to do it at&nbsp;the soc analyst scrolls<\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><strong>Either Clone the Repo or Install AzureHunter from the PSGallery<\/strong><\/p>\n\n\n\n<p class=\"has-text-align-center\"><strong>Cloning the Repo<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Clone this repository<\/li><li>Import the module&nbsp;<code><strong>Import-Module .\\source\\AzureHunter.psd1<\/strong><\/code><\/li><\/ol>\n\n\n\n<p class=\"has-text-align-center\"> <strong>Install AzureHunter from the PSGallery<\/strong><\/p>\n\n\n\n<p>All you need to do is:<\/p>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>Install-Module AzureHunter -Scope CurrentUser<br>Import-Module AzureHunter<\/strong><\/p>\n\n\n\n<p class=\"has-text-align-center has-vivid-green-cyan-background-color has-background\"><strong>What Is The UnifiedAuditLog?<\/strong><\/p>\n\n\n\n<p>The unified audit log contains user, group, application, domain, and directory activities performed in the Microsoft 365 admin center or in the Azure management portal. For a complete list of Azure AD events, see the list of&nbsp;RecordTypes.<\/p>\n\n\n\n<p>The UnifiedAuditLog is a great source of cloud forensic information since it contains a wealth of data on multiple types of cloud operations like ExchangeItems, SharePoint, Azure AD, OneDrive, Data Governance, Data Loss Prevention, Windows Defender Alerts and Quarantine events, Threat intelligence events in Microsoft Defender for Office 365 and the list goes on and on!<\/p>\n\n\n\n<p class=\"has-text-align-center has-vivid-green-cyan-background-color has-background\"><a href=\"https:\/\/github.com\/darkquasar\/AzureHunter#azurehunter-data-consistency-checks\"><\/a><strong>AzureHunter Data Consistency Checks<\/strong><\/p>\n\n\n\n<p>AzureHunter implements some useful logic to ensure that the highest log density is mined and exported from Azure &amp; O365 Audit Logs. In order to do this, we run two different operations for each cycle (batch):<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Automatic Window Time Reduction<\/strong>: this check ensures that the time interval is reduced to the optimal interval based on the&nbsp;<strong>ResultSizeUpperThreshold<\/strong>&nbsp;parameter which by default is 20k. This means, if the amounts of logs returned within your designated&nbsp;<strong>TimeInterval<\/strong>&nbsp;is higher than&nbsp;<strong>ResultSizeUpperThreshold<\/strong>, then an automatic adjustment will take place.<\/li><li><strong>Sequential Data Check<\/strong>: are returned Record Indexes sequentially valid?<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEj-qFED47rqcQy9G5lyRJx3zw5dIQSYotrXkwf0vx7KajGWpcnPuG_q4wPHG4VLnVodFK0s7Pb4AwqPUbDY2HgkwtWevXLbj93utu1PACxFmFqL4Z48Ztf_G5eHC4a8AVQVb2irxZrJcYQ2Q9P5Bsp7utRs1hnSdggonC9aECVzFnYlaaq1jLO81fqL=s2640\" alt=\"\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center has-vivid-green-cyan-background-color has-background\"><strong>Usage<\/strong><\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><a href=\"https:\/\/github.com\/darkquasar\/AzureHunter#ensure-you-connect-to-exchangeonline\"><\/a><strong>Ensure you connect to ExchangeOnline<\/strong><\/p>\n\n\n\n<p>It&#8217;s recommended that you run&nbsp;<code><strong>Connect-ExchangeOnline<\/strong><\/code>&nbsp;before running any&nbsp;<code><strong>AzureHunter<\/strong><\/code>&nbsp;commands. The program checks for an active remote session and attempts to connect but some versions of Powershell don&#8217;t allow this and you need to do it yourself regardless.<\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><a href=\"https:\/\/github.com\/darkquasar\/AzureHunter#run-azurehunter\"><\/a><strong>Run AzureHunter<\/strong><\/p>\n\n\n\n<p><strong>AzureHunter<\/strong>&nbsp;has two main commands:&nbsp;<code><strong>Search-AzureCloudUnifiedLog<\/strong><\/code>&nbsp;and&nbsp;<code><strong>Invoke-AzHunterPlaybook<\/strong><\/code>.<\/p>\n\n\n\n<p>The purpose of&nbsp;<code><strong>Search-AzureCloudUnif<\/strong>iedLog<\/code>&nbsp;is to implement a complex logic to ensure that the highest percentage of&nbsp;<em>UnifiedAuditLog records<\/em>&nbsp;are mined from Azure. By default, it will export extracted and deduplicated records to a CSV file.<\/p>\n\n\n\n<p>The purpose of&nbsp;<code><strong>Invoke-AzHunterPlaybook<\/strong><\/code>&nbsp;is to provide a flexible interface into hunting playbooks stored in the&nbsp;<code><strong>playbooks<\/strong><\/code>&nbsp;folder. These playbooks are designed so that anyone can contribute with their own analytics and ideas. So far, only two very simple playbooks have been developed:&nbsp;<code><strong>AzHunter.Playbook.Exporter<\/strong><\/code>&nbsp;and&nbsp;<code><strong>AzHunter.Playbook.LogonAnalyser<\/strong><\/code>. The&nbsp;<code><strong>Exporter<\/strong><\/code>&nbsp;takes care of exporting records after applying de-duplication and sorting operations to the data. The&nbsp;<code><strong>LogonAnalyser<\/strong><\/code>&nbsp;is in beta mode and extracts events where the&nbsp;<code><strong>Operations<\/strong><\/code>&nbsp;property is&nbsp;<code><strong>UserLoggedIn<\/strong><\/code>. It is an example of what can be done with the playbooks and how easy it is to construct one.<\/p>\n\n\n\n<p>When running&nbsp;<code><strong>Search-AzureCloudUnifiedLog<\/strong><\/code>, you can pass in a list of playbooks to run per log batch.&nbsp;<code><strong>Search-AzureCloudUnifiedLog<\/strong><\/code>&nbsp;will pass on the batch to the playbooks via&nbsp;<strong><code>Invoke-AzHunterPlaybook<\/code>.<\/strong><\/p>\n\n\n\n<p>Finally&nbsp;<code>I<strong>nvoke-AzHunterPlaybook<\/strong><\/code>&nbsp;can, be used standalone. If you have an export of UnifiedAuditLog records, you can load them into a Powershell Array and pass them on to this command and specify the relevant playbooks.<\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><a href=\"https:\/\/github.com\/darkquasar\/AzureHunter#example-1--run-search-on-azure-unifiedauditlog-and-extract-records-to-csv-file-default-behaviour\"><\/a><strong>Example 1 | Run search on Azure UnifiedAuditLog and extract records to CSV file (default behaviour)<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>Search-AzureCloudUnifiedLog -StartDate &#8220;2020-03-06T10:00:00&#8221; -EndDate &#8220;2020-06-09T12:40:00&#8221; -TimeInterval 12 -AggregatedResultsFlushSize 5000 -Verbose<\/strong><\/p>\n\n\n\n<p>This command will:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Search data between the dates in&nbsp;<em>StartDate<\/em>&nbsp;and&nbsp;<em>EndDate<\/em><\/li><li>Implement a window of 12 hours between these dates, which will be used to sweep the entire length of the time interval (StartDate &#8211;&gt; EndDate). This window will be&nbsp;<strong>automatically reduced and adjusted<\/strong>&nbsp;to provide the maximum amount of records within the window, thus ensuring higher quality of output. The time window slides sequentially until reaching the&nbsp;<strong>EndDate<\/strong>.<\/li><li>The&nbsp;<code>AggregatedResultsFlushSize<\/code>&nbsp;parameter speficies the batches of records that will be processed by downstream playbooks. We are telling&nbsp;<strong>AzureHunter<\/strong>&nbsp;here to process the batch of records once the total amount reaches&nbsp;<strong>5000<\/strong>. This way, you can get results on the fly, without having to wait for hours until a huge span of records is exported to CSV files.<\/li><\/ul>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><a href=\"https:\/\/github.com\/darkquasar\/AzureHunter#example-2--run-hunting-playbooks-on-csv-file\"><\/a><strong>Example 2 | Run<\/strong> <strong>Hunting Playbooks on CSV File<\/strong><\/p>\n\n\n\n<p>We assume that you have exported UnifiedAuditLog records to a CSV file, if so you can then do:<\/p>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>$RecordArray = Import-Csv .\\my-exported-records.csv<br>Invoke-AzHunterPlaybook -Records $RecordArray -Playbooks &#8216;AzHunter.Playbook.UAL.LogonAnalyser&#8217;<\/strong><\/p>\n\n\n\n<p>You can run more than one playbook by separating them via commas, they will run sequentially:<\/p>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>$RecordArray = Import-Csv .\\my-exported-records.csv<br>Invoke-AzHunterPlaybook -Records $RecordArray -Playbooks &#8216;AzHunter.Playbook.UAL.Exporter&#8217;, &#8216;AzHunter.Playbook.UAL.LogonAnalyser&#8217;<\/strong><\/p>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background\"><strong>Example 3 | Run Hunting Playbook to produce a clean eDiscovery Summary Report<\/strong><\/p>\n\n\n\n<p>We assume that you have exported an eDiscovery Summary Report to a CSV file, if so you can then do:<\/p>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>$eDiscoReportFile = .\\eDisco-Summary-Report-PersonOfInterest.csv<br>Invoke-AzHunterPlaybook -Records $eDiscoReportFile -Playbooks &#8216;AzHunter.Playbook.eDisco.SummaryReportCleaner&#8217;<\/strong><\/p>\n\n\n\n<p>Optionally we can pass some parameters to the playbook like so:<\/p>\n\n\n\n<p class=\"has-vivid-green-cyan-color has-black-background-color has-text-color has-background\"><strong>$eDiscoReportFile = .\\eDisco-Summary-Report-PersonOfInterest.csv<br>Invoke-AzHunterPlaybook -Records $eDiscoReportFile -Playbooks &#8216;AzHunter.Playbook.eDisco.SummaryReportCleaner&#8217; -PlayBookParameters @{&#8220;CsvRecordsBatchSize&#8221; = 700}<\/strong><\/p>\n\n\n\n<p>The paramenter &#8220;CsvRecordsBatchSize&#8221; will tell the playbook to flush records to disk in batches of 700 records.<\/p>\n\n\n\n<p class=\"has-text-align-center has-vivid-green-cyan-background-color has-background\"><a href=\"https:\/\/github.com\/darkquasar\/AzureHunter#why\"><\/a><strong>Why?<\/strong><\/p>\n\n\n\n<p>Since the aftermath of the&nbsp;<em>SolarWinds Supply Chain Compromise<\/em>&nbsp;many tools have emerged out of deep forges of cyberforensicators, carefully developed by cyber blacksmith ninjas. These tools usually help you perform cloud forensics in Azure. My intention with AzureHunter is not to bring more noise to this crowded space, however, I found myself in the need to address some gaps that I have observed in some of the tools in the space (I might be wrong though, since there is a proliferation of tools out there and I don&#8217;t know them all&#8230;):<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><em>Azure cloud forensic tools don&#8217;t usually address the complications of the Powershell API for the&nbsp;<code><strong>UnifiedAuditLog<\/strong><\/code><\/em>. This API is&nbsp;<strong>very unstable and inconsistent<\/strong>&nbsp;when exporting large quantities of data. I wanted to develop an interface that is fault tolerant (<strong>enough<\/strong>) to address some of these issues focusing solely on the&nbsp;<em>UnifiedAuditLog<\/em>&nbsp;since this is the Azure artefact that contains the most relevant and detailed activity logs for users, applications and services.<\/li><li><em>Azure cloud forensic tools don&#8217;t usually put focus on developing extensible&nbsp;<code><strong>Playbooks<\/strong><\/code><\/em>. I wanted to come up with a simple framework that would help the community create and share new playbooks to extract different types of meaning off the same data.<\/li><\/ol>\n\n\n\n<p>If, however,&nbsp;<strong>you are looking for a more feature rich and mature application for Azure Cloud Forensics<\/strong>&nbsp;I would suggest you check out the excellent work performed by the cyber security experts that created the following applications:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>CISA&#8217;s&nbsp;Sparrow<\/li><li>HAWK<\/li><li>CrowdStrike Reporting Tool for Azure&nbsp;CRT<\/li><\/ul>\n\n\n\n<p><em>I&#8217;m sure there is a more extensive list of tools, but these are the ones I could come up with. Feel free to suggest some more.<\/em><\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link has-vivid-cyan-blue-background-color has-background\" href=\"https:\/\/github.com\/darkquasar\/AzureHunter\"><strong>Download<\/strong><\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes Getting Started Check that you have the right O365 Permissions The following roles are required in Exchange Online, in order to be able to have&nbsp;read only&nbsp;access to the UnifiedAuditLog:&nbsp;View-Only Audit Logs&nbsp;or&nbsp;Audit Logs. These roles are [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":20892,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[28],"tags":[315,4533,4534,4504,2579],"class_list":["post-20874","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kali","tag-azure","tag-azurehunter","tag-cloud-forensics","tag-o365","tag-powershell-module"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AzureHunter : A Cloud Forensics Powershell Module To Run Threat<\/title>\n<meta name=\"description\" content=\"AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kalilinuxtutorials.com\/azurehunter\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AzureHunter : A Cloud Forensics Powershell Module To Run Threat\" \/>\n<meta property=\"og:description\" content=\"AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kalilinuxtutorials.com\/azurehunter\/\" \/>\n<meta property=\"og:site_name\" content=\"Kali Linux Tutorials\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-23T17:09:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728\" \/>\n<meta name=\"author\" content=\"R K\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728\" \/>\n<meta name=\"twitter:creator\" content=\"@CyberEdition\" \/>\n<meta name=\"twitter:site\" content=\"@CyberEdition\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"R K\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/azurehunter\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/azurehunter\/\"},\"author\":{\"name\":\"R K\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad\"},\"headline\":\"AzureHunter : A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365\",\"datePublished\":\"2021-12-23T17:09:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/azurehunter\/\"},\"wordCount\":1323,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/azurehunter\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728\",\"keywords\":[\"Azure\",\"AzureHunter\",\"Cloud Forensics\",\"O365\",\"Powershell module\"],\"articleSection\":[\"Kali Linux\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/kalilinuxtutorials.com\/azurehunter\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/azurehunter\/\",\"url\":\"https:\/\/kalilinuxtutorials.com\/azurehunter\/\",\"name\":\"AzureHunter : A Cloud Forensics Powershell Module To Run Threat\",\"isPartOf\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/azurehunter\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/azurehunter\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728\",\"datePublished\":\"2021-12-23T17:09:00+00:00\",\"description\":\"AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/kalilinuxtutorials.com\/azurehunter\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/azurehunter\/#primaryimage\",\"url\":\"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728\",\"contentUrl\":\"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728\",\"width\":\"728\",\"height\":\"380\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#website\",\"url\":\"https:\/\/kalilinuxtutorials.com\/\",\"name\":\"Kali Linux Tutorials\",\"description\":\"Kali Linux Tutorials\",\"publisher\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/kalilinuxtutorials.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\",\"name\":\"Kali Linux Tutorials\",\"url\":\"https:\/\/kalilinuxtutorials.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png\",\"contentUrl\":\"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png\",\"width\":272,\"height\":90,\"caption\":\"Kali Linux Tutorials\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/CyberEdition\",\"https:\/\/www.threads.com\/@cybersecurityedition\",\"https:\/\/www.linkedin.com\/company\/cyberedition\",\"https:\/\/www.instagram.com\/cybersecurityedition\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad\",\"name\":\"R K\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g\",\"caption\":\"R K\"},\"url\":\"https:\/\/kalilinuxtutorials.com\/author\/ranjith\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AzureHunter : A Cloud Forensics Powershell Module To Run Threat","description":"AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kalilinuxtutorials.com\/azurehunter\/","og_locale":"en_US","og_type":"article","og_title":"AzureHunter : A Cloud Forensics Powershell Module To Run Threat","og_description":"AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes.","og_url":"https:\/\/kalilinuxtutorials.com\/azurehunter\/","og_site_name":"Kali Linux Tutorials","article_published_time":"2021-12-23T17:09:00+00:00","og_image":[{"url":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728","type":"","width":"","height":""}],"author":"R K","twitter_card":"summary_large_image","twitter_image":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728","twitter_creator":"@CyberEdition","twitter_site":"@CyberEdition","twitter_misc":{"Written by":"R K","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kalilinuxtutorials.com\/azurehunter\/#article","isPartOf":{"@id":"https:\/\/kalilinuxtutorials.com\/azurehunter\/"},"author":{"name":"R K","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad"},"headline":"AzureHunter : A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365","datePublished":"2021-12-23T17:09:00+00:00","mainEntityOfPage":{"@id":"https:\/\/kalilinuxtutorials.com\/azurehunter\/"},"wordCount":1323,"commentCount":0,"publisher":{"@id":"https:\/\/kalilinuxtutorials.com\/#organization"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/azurehunter\/#primaryimage"},"thumbnailUrl":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728","keywords":["Azure","AzureHunter","Cloud Forensics","O365","Powershell module"],"articleSection":["Kali Linux"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/kalilinuxtutorials.com\/azurehunter\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/kalilinuxtutorials.com\/azurehunter\/","url":"https:\/\/kalilinuxtutorials.com\/azurehunter\/","name":"AzureHunter : A Cloud Forensics Powershell Module To Run Threat","isPartOf":{"@id":"https:\/\/kalilinuxtutorials.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kalilinuxtutorials.com\/azurehunter\/#primaryimage"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/azurehunter\/#primaryimage"},"thumbnailUrl":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728","datePublished":"2021-12-23T17:09:00+00:00","description":"AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kalilinuxtutorials.com\/azurehunter\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/azurehunter\/#primaryimage","url":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728","contentUrl":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728","width":"728","height":"380"},{"@type":"WebSite","@id":"https:\/\/kalilinuxtutorials.com\/#website","url":"https:\/\/kalilinuxtutorials.com\/","name":"Kali Linux Tutorials","description":"Kali Linux Tutorials","publisher":{"@id":"https:\/\/kalilinuxtutorials.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kalilinuxtutorials.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/kalilinuxtutorials.com\/#organization","name":"Kali Linux Tutorials","url":"https:\/\/kalilinuxtutorials.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/","url":"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png","contentUrl":"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png","width":272,"height":90,"caption":"Kali Linux Tutorials"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/CyberEdition","https:\/\/www.threads.com\/@cybersecurityedition","https:\/\/www.linkedin.com\/company\/cyberedition","https:\/\/www.instagram.com\/cybersecurityedition\/"]},{"@type":"Person","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad","name":"R K","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g","caption":"R K"},"url":"https:\/\/kalilinuxtutorials.com\/author\/ranjith\/"}]}},"jetpack_featured_media_url":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEh8lv83GiUncdS-5en6kr5_cfJrpYQ8VCiOLH-fllAqWcv0_fAfbwxoFQR9LahFXHCNNToJ70zi2GY_brsOk1Cg4ndO4jTltsfjIoTmYGwtd2jQWKP_W--pGmSJw-yNdSk3o_sib2xEX2DFF6DHyPTbjtWQr5wCTFofWNtvvkBx0UUwMrKtFvWpjZpX=s728","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":31276,"url":"https:\/\/kalilinuxtutorials.com\/awesome-bec\/","url_meta":{"origin":20874,"position":0},"title":"Awesome-BEC &#8211; Unveiling A Comprehensive Resource For Business Email Compromise Investigations","author":"Varshini","date":"November 14, 2023","format":false,"excerpt":"A Comprehensive Resource for Business Email Compromise Investigations.' In the ever-evolving landscape of cyber threats, business email compromise (BEC) remains a persistent and costly threat. This article explores Awesome-BEC, a curated repository of invaluable attack and defensive information, tools, and research dedicated to combating BEC attacks. Discover the wealth of\u2026","rel":"","context":"In &quot;Cyber security&quot;","block_context":{"text":"Cyber security","link":"https:\/\/kalilinuxtutorials.com\/category\/cyber-security\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhFs0qjA7Sg-PMvScoWTDuAWmHL_hlhRggQ1Szz4rKosfuyAM-Ns00EPf1FOFpx20fXS8nx7j5Y2tcw7PqZPOpdcx4oxB9F2JG5Ca1AWS9kA2sgmm6hC8qZs10ZnP0tRUeef65aO-LtngTWgPpj8WIDqG8GZZlBC4C3Hn3sz_SfZuHdJbxjpUX7yjDbmA\/s16000\/BEC.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhFs0qjA7Sg-PMvScoWTDuAWmHL_hlhRggQ1Szz4rKosfuyAM-Ns00EPf1FOFpx20fXS8nx7j5Y2tcw7PqZPOpdcx4oxB9F2JG5Ca1AWS9kA2sgmm6hC8qZs10ZnP0tRUeef65aO-LtngTWgPpj8WIDqG8GZZlBC4C3Hn3sz_SfZuHdJbxjpUX7yjDbmA\/s16000\/BEC.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhFs0qjA7Sg-PMvScoWTDuAWmHL_hlhRggQ1Szz4rKosfuyAM-Ns00EPf1FOFpx20fXS8nx7j5Y2tcw7PqZPOpdcx4oxB9F2JG5Ca1AWS9kA2sgmm6hC8qZs10ZnP0tRUeef65aO-LtngTWgPpj8WIDqG8GZZlBC4C3Hn3sz_SfZuHdJbxjpUX7yjDbmA\/s16000\/BEC.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhFs0qjA7Sg-PMvScoWTDuAWmHL_hlhRggQ1Szz4rKosfuyAM-Ns00EPf1FOFpx20fXS8nx7j5Y2tcw7PqZPOpdcx4oxB9F2JG5Ca1AWS9kA2sgmm6hC8qZs10ZnP0tRUeef65aO-LtngTWgPpj8WIDqG8GZZlBC4C3Hn3sz_SfZuHdJbxjpUX7yjDbmA\/s16000\/BEC.webp?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":13128,"url":"https:\/\/kalilinuxtutorials.com\/dfir-o365rc-power\/","url_meta":{"origin":20874,"position":1},"title":"DFIR-O365RC : PowerShell Module For Office 365 And Azure AD Log Collection","author":"R K","date":"May 30, 2021","format":false,"excerpt":"The DFIR-O365RC PowerShell module is a set of functions that allow the DFIR analyst to collect logs relevant for Office 365 Business Email Compromise investigations. The logs are generated in JSON format and retrieved from two main data sources: Office 365\u00a0Unified Audit Logs.Azure AD\u00a0sign-ins logs\u00a0and\u00a0audit logs. The two data sources\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":24831,"url":"https:\/\/kalilinuxtutorials.com\/365inspect\/","url_meta":{"origin":20874,"position":2},"title":"365Inspect : A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments","author":"R K","date":"May 29, 2022","format":false,"excerpt":"365Inspect\u00a0requires the administrative PowerShell modules for Microsoft Online, Azure AD (We recommend installing the AzureADPreview module), Exchange administration, Microsoft Graph, Microsoft Intune, Microsoft Teams, and Sharepoint administration. The 365Inspect.ps1 PowerShell script will validate the installed modules. If you do not have these modules installed, you will be prompted to install\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEij5QrG5U69qJNHfoa0D2jUaXIhlOlWXFy-hf8vEVn0s8-S07mD2EB9X0F8x0Xltq73oUJWXD4vb0e-5aTNNhiT5efUuux_4A7jzEFYOW7W-ZXbxmG04IZnXtrNSL8u_ZWhg_FS2e9cfmF2sbsVUd3VBiD2tsXy5E6lZ1XTTrq9ihkqX-Y92HoSiXCg\/s728\/365.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEij5QrG5U69qJNHfoa0D2jUaXIhlOlWXFy-hf8vEVn0s8-S07mD2EB9X0F8x0Xltq73oUJWXD4vb0e-5aTNNhiT5efUuux_4A7jzEFYOW7W-ZXbxmG04IZnXtrNSL8u_ZWhg_FS2e9cfmF2sbsVUd3VBiD2tsXy5E6lZ1XTTrq9ihkqX-Y92HoSiXCg\/s728\/365.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEij5QrG5U69qJNHfoa0D2jUaXIhlOlWXFy-hf8vEVn0s8-S07mD2EB9X0F8x0Xltq73oUJWXD4vb0e-5aTNNhiT5efUuux_4A7jzEFYOW7W-ZXbxmG04IZnXtrNSL8u_ZWhg_FS2e9cfmF2sbsVUd3VBiD2tsXy5E6lZ1XTTrq9ihkqX-Y92HoSiXCg\/s728\/365.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEij5QrG5U69qJNHfoa0D2jUaXIhlOlWXFy-hf8vEVn0s8-S07mD2EB9X0F8x0Xltq73oUJWXD4vb0e-5aTNNhiT5efUuux_4A7jzEFYOW7W-ZXbxmG04IZnXtrNSL8u_ZWhg_FS2e9cfmF2sbsVUd3VBiD2tsXy5E6lZ1XTTrq9ihkqX-Y92HoSiXCg\/s728\/365.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":22845,"url":"https:\/\/kalilinuxtutorials.com\/crt\/","url_meta":{"origin":20874,"position":3},"title":"CRT : CrowdStrike Reporting Tool for Azure","author":"R K","date":"March 14, 2022","format":false,"excerpt":"CRT is a tool to queries the following configurations in the Azure AD\/O365 tenant which can shed light on hard-to-find permissions and configuration settings in order to assist organizations in securing these environments. Exchange Online (O365): Federation ConfigurationFederation TrustClient Access Settings Configured on MailboxesMail Forwarding Rules for Remote DomainsMailbox SMTP\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEhD2igjoH8CWeN5YpElrHGEHUhw7D7VXm9Ve1qoYVEMZABkXkkwYDlReQFyIrrbCJlaiV6Vx6D-KjJb01GVAy390675HZAmyg1grj9IY4zCSPjx3Rt_YwKGVXjXzZp4PjEymispebNZ_CbioUjNSaf-MEEXaXQzpKUL9gXLyh6AjR7M0G3pE7tf7G72=s760","width":350,"height":200,"srcset":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEhD2igjoH8CWeN5YpElrHGEHUhw7D7VXm9Ve1qoYVEMZABkXkkwYDlReQFyIrrbCJlaiV6Vx6D-KjJb01GVAy390675HZAmyg1grj9IY4zCSPjx3Rt_YwKGVXjXzZp4PjEymispebNZ_CbioUjNSaf-MEEXaXQzpKUL9gXLyh6AjR7M0G3pE7tf7G72=s760 1x, https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEhD2igjoH8CWeN5YpElrHGEHUhw7D7VXm9Ve1qoYVEMZABkXkkwYDlReQFyIrrbCJlaiV6Vx6D-KjJb01GVAy390675HZAmyg1grj9IY4zCSPjx3Rt_YwKGVXjXzZp4PjEymispebNZ_CbioUjNSaf-MEEXaXQzpKUL9gXLyh6AjR7M0G3pE7tf7G72=s760 1.5x, https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEhD2igjoH8CWeN5YpElrHGEHUhw7D7VXm9Ve1qoYVEMZABkXkkwYDlReQFyIrrbCJlaiV6Vx6D-KjJb01GVAy390675HZAmyg1grj9IY4zCSPjx3Rt_YwKGVXjXzZp4PjEymispebNZ_CbioUjNSaf-MEEXaXQzpKUL9gXLyh6AjR7M0G3pE7tf7G72=s760 2x"},"classes":[]},{"id":34488,"url":"https:\/\/kalilinuxtutorials.com\/office-365-extractor\/","url_meta":{"origin":20874,"position":4},"title":"Office 365 Extractor &#8211; A Complete Guide To Extracting Audit Logs And Enhancing Forensic Investigations","author":"Varshini","date":"August 19, 2024","format":false,"excerpt":"This script makes it possible to extract log data out of an Office365 environment. The script created by us consist out of four main options, which enable the investigator to easily extract logging out of an Office365 environment. Show available log sources and amount of logging Extract all audit logging\u2026","rel":"","context":"In &quot;Forensics&quot;","block_context":{"text":"Forensics","link":"https:\/\/kalilinuxtutorials.com\/category\/f\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg4lpTYHzZsOChfj2T85B9AI6t2WbveZkRFiPYbs7OvnKOfRGRtkJXZahfP04No99PwRgGtHVmVSh-8_4u2C43PqOIVbWl8vPefYTHFylgRJtk4bG21s7ZSky4TVKFX1uCc8gtiRj6yUdDkU22yM_qgXcDnDzrJadjuMT5CYBqlbWAagYon5rMFefCWMOPc\/s16000\/Office%20365%20Extractor.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg4lpTYHzZsOChfj2T85B9AI6t2WbveZkRFiPYbs7OvnKOfRGRtkJXZahfP04No99PwRgGtHVmVSh-8_4u2C43PqOIVbWl8vPefYTHFylgRJtk4bG21s7ZSky4TVKFX1uCc8gtiRj6yUdDkU22yM_qgXcDnDzrJadjuMT5CYBqlbWAagYon5rMFefCWMOPc\/s16000\/Office%20365%20Extractor.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg4lpTYHzZsOChfj2T85B9AI6t2WbveZkRFiPYbs7OvnKOfRGRtkJXZahfP04No99PwRgGtHVmVSh-8_4u2C43PqOIVbWl8vPefYTHFylgRJtk4bG21s7ZSky4TVKFX1uCc8gtiRj6yUdDkU22yM_qgXcDnDzrJadjuMT5CYBqlbWAagYon5rMFefCWMOPc\/s16000\/Office%20365%20Extractor.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg4lpTYHzZsOChfj2T85B9AI6t2WbveZkRFiPYbs7OvnKOfRGRtkJXZahfP04No99PwRgGtHVmVSh-8_4u2C43PqOIVbWl8vPefYTHFylgRJtk4bG21s7ZSky4TVKFX1uCc8gtiRj6yUdDkU22yM_qgXcDnDzrJadjuMT5CYBqlbWAagYon5rMFefCWMOPc\/s16000\/Office%20365%20Extractor.webp?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg4lpTYHzZsOChfj2T85B9AI6t2WbveZkRFiPYbs7OvnKOfRGRtkJXZahfP04No99PwRgGtHVmVSh-8_4u2C43PqOIVbWl8vPefYTHFylgRJtk4bG21s7ZSky4TVKFX1uCc8gtiRj6yUdDkU22yM_qgXcDnDzrJadjuMT5CYBqlbWAagYon5rMFefCWMOPc\/s16000\/Office%20365%20Extractor.webp?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg4lpTYHzZsOChfj2T85B9AI6t2WbveZkRFiPYbs7OvnKOfRGRtkJXZahfP04No99PwRgGtHVmVSh-8_4u2C43PqOIVbWl8vPefYTHFylgRJtk4bG21s7ZSky4TVKFX1uCc8gtiRj6yUdDkU22yM_qgXcDnDzrJadjuMT5CYBqlbWAagYon5rMFefCWMOPc\/s16000\/Office%20365%20Extractor.webp?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":11267,"url":"https:\/\/kalilinuxtutorials.com\/skyark\/","url_meta":{"origin":20874,"position":5},"title":"SkyArk : A Cloud Security Project With Two Main Scanning Modules","author":"R K","date":"August 20, 2020","format":false,"excerpt":"SkyArk is a cloud security project with two main scanning modules: AzureStealth - Scans Azure environmentsAWStealth - Scan AWS environments These two scanning modules will discover the most privileged entities in the target AWS and Azure. The Main Goal - Discover The Most Privileged Cloud Users It currently focuses on\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts\/20874","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/comments?post=20874"}],"version-history":[{"count":18,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts\/20874\/revisions"}],"predecessor-version":[{"id":21004,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts\/20874\/revisions\/21004"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/media\/20892"}],"wp:attachment":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/media?parent=20874"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/categories?post=20874"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/tags?post=20874"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}